Online Store Malware Learns to Hide From Security Scanners, Infecting 953 Shops

Attackers have infected 953 online stores, mostly running Magento, with a JavaScript loader that can tell security scanners apart from real shoppers. Research from Dutch e-commerce security firm Sansec says the campaign has been active since July 2025 and has used five loader domains. The loader is stored in the Magento database table that holds CMS content blocks, and it makes visitors' browsers fetch instructions from the attackers. The server gives scanners nothing, which makes the infection hard to spot.

The code has evolved. A version first found on October 7 called the new domain directly and replayed saved code in the browser, so it could keep running even if the domain was taken down or blocked. An October 23 rewrite added browser fingerprinting, checking for signs of automation and collecting details such as hardware, screen size, time zone and language. When urlscan.io loaded an infected store, Sansec found no injected content. The final payload has not been obtained, so the campaign's purpose remains unclear.

Patching alone did not stop reinfection. Sansec reported that a fully patched store running Magento 2.4.7-p10 picked up the newest loader an hour after passing a clean scan, having shown a rogue admin account and a backdoor in September. Sansec advised merchants to check CMS content for the loader, review admin accounts, hunt for backdoors, rotate database, admin and integration credentials once the store is clean, and apply the latest Magento and Adobe Commerce security updates.